InstallPE
InstallRT
InstallSA
InstallSB
PEmain
ServiceMain
UninstallPE
UninstallRT
UninstallSA
UninstallSB
Static task
static1
Behavioral task
behavioral1
Sample
e21c6865456bfa74e7b00d14b13cfebe_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e21c6865456bfa74e7b00d14b13cfebe_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
e21c6865456bfa74e7b00d14b13cfebe_JaffaCakes118
Size
72KB
MD5
e21c6865456bfa74e7b00d14b13cfebe
SHA1
02dfdc240b680aafdc5d6eaf570acaedba158980
SHA256
f0769ab9895aff83cfa493acc9373f79797593b906ea2d940fc1b98ebb065ce6
SHA512
bb9c48889c54681154c0d24771a6e3cf2676c7904e366f7c4ef73fb82683785af454ae500491469e3af57fc287733f0ed4d0b464d1b4165c9402cda617cd4976
SSDEEP
1536:rcT2WGOgIIJLsplmLXnPUJh6wL+lUG2Tu9oI9BxASQBfeHr+8BXmqkmk:g6ZnU4Qq9oI9B7QBf+r+8BXmqkr
Checks for missing Authenticode signature.
resource |
---|
e21c6865456bfa74e7b00d14b13cfebe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetThreadDesktop
OpenDesktopA
SetProcessWindowStation
MessageBoxA
GetThreadDesktop
GetProcessWindowStation
GetDesktopWindow
CloseWindowStation
OpenWindowStationA
ExitWindowsEx
CloseDesktop
GetModuleFileNameExA
EnumProcessModules
select
gethostbyname
inet_ntoa
recv
send
connect
ntohs
WSAGetLastError
socket
closesocket
WSAStartup
WSACleanup
setsockopt
htons
inet_addr
CreateServiceA
RegCreateKeyA
RegisterServiceCtrlHandlerA
QueryServiceConfigA
ChangeServiceConfigA
QueryServiceStatus
ControlService
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
SetServiceStatus
RegOpenKeyA
RegEnumKeyA
RegDeleteValueA
RegSetValueExA
CreateProcessAsUserA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
DeleteService
GetAdaptersInfo
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
??3@YAXPAX@Z
ftell
??2@YAPAXI@Z
_strrev
fread
__CxxFrameHandler
_CxxThrowException
wcstombs
_except_handler3
isdigit
strtoul
strncat
_strupr
strcmp
strtok
malloc
free
_vsnprintf
fprintf
_strtime
strcat
sprintf
strstr
strrchr
fopen
fwrite
fclose
printf
memcmp
strncmp
strchr
memset
strlen
strcpy
memcpy
strncpy
atoi
_stricmp
_strnicmp
_strlwr
_strdate
fseek
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
Module32Next
GetFileSize
SetFileAttributesA
SetLastError
FindClose
SuspendThread
TerminateProcess
ReadFile
CreateProcessA
GetStartupInfoA
CreatePipe
GetLocalTime
GetVolumeInformationA
FindNextFileA
CreateDirectoryA
GetFileAttributesA
RemoveDirectoryA
MoveFileA
GetFileTime
VirtualQuery
FindFirstFileA
GetSystemDirectoryA
CreateMutexA
Module32First
WriteProcessMemory
MultiByteToWideChar
VirtualAllocEx
LocalAlloc
GetSystemTime
SystemTimeToFileTime
GetWindowsDirectoryA
CreateFileA
SetFileTime
GetVersion
CreateRemoteThread
WaitForSingleObject
GetSystemDefaultLangID
OpenProcess
GetCurrentThreadId
GetCurrentDirectoryA
SetCurrentDirectoryA
GetModuleFileNameA
MoveFileExA
CopyFileA
FreeConsole
GetComputerNameA
GlobalMemoryStatus
GetModuleHandleA
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetVersionExA
GetCurrentProcess
GetLastError
GetStdHandle
WriteFile
OutputDebugStringA
DeleteFileA
LoadLibraryA
GetProcAddress
GetTickCount
CreateThread
CloseHandle
FreeLibrary
ExitThread
WinExec
Sleep
GetCurrentProcessId
InstallPE
InstallRT
InstallSA
InstallSB
PEmain
ServiceMain
UninstallPE
UninstallRT
UninstallSA
UninstallSB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ